auditing newbie help please

[Ken Penland_1]

We are running HPUX 11.0 in trusted mode and have just been required to turn auditing on. Most of our systems this worked without a hitch, but one V class system freaked out on us when auditing was turned on over night and sent us about 600 emails containing:

Cron: Your job did not contain a valid audit ID.
See your system administrator.

does anyone know what this means and how to fix it? I know each user has an "auditid" in their auth file, and I have a feeling one of these may be incorrect somehow, but I have no idea how to tell who, what, or why.

Help please!

[Bharat Katkar]

Hi,
Go thr' the doc attached, look for the Auditing Section.
That should help.
Regards,

[Ken Penland_1]

Hrm, couldn't find an auditing section in that doc.

I actually found the answer shortly after I posted...I continued to research and found that the /var/spool/cron/.cronaids directory was missing so I had to run a tsconvert -p to re-create it.

[Hemanth Gurunath Basrur]

Hello Ken,

Can you please check if the foll. links help?

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90121/B2355-90121_top.html&con=/hpux/onlinedocs/B2355-90121/00/00/37-con.html&toc=/hpux/onlinedocs/B2355-90121/00/00/37-toc.html&searchterms=ID%7caudit&queryid=20040708-012405

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/5187-2216/5187-2216_top.html&con=/hpux/onlinedocs/5187-2216/00/00/72-con.html&toc=/hpux/onlinedocs/5187-2216/00/00/72-toc.html&searchterms=Auditing&queryid=20040708-012545

http://h30097.www3.hp.com/docs/base_doc/DOCUMENTATION/V51A_HTML/ARH95DTE/CDDSBXXX.HTM

Regards,
Hemanth